Diffie-Hellman protocol-based iSCSI protocol security enhancement method

Abstract

The invention discloses a Diffie-Hellman protocol-based iSCSI protocol security enhancement method. The method comprises the steps that an originating terminal sends a public key certificate, a request and a digital signature of the originating terminal to an authentication server; the authentication server authenticates the identity of the originating terminal and authorizes the request; the authentication server sends both a ciphertext and a public part of the certificate to the originating terminal of the request, wherein the ciphertext is obtained by encrypting a private part of the certificate by a public key of the originating terminal; the originating terminal calculates a message verification code and sends both the message verification code and the public part of the certificate to a designated target terminal; the target terminal receives the verification code and the public part of the certificate and then authorizes the request of the originating terminal; the target terminal responds to the request of the originating terminal according to an authorization result; and used shared secret keys are refreshed one by one regularly.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to an iSCSI protocol security enhancement method based on the Diffie-Hellman protocol. Background technique [0002] Currently, the iSCSI protocol mostly uses the CHAP authentication protocol to control access to storage resources. However, in CHAP authentication, the user name and password are stored on the target side in plain text, which may be illegally obtained by insiders or hackers. In addition, this authentication method uses periodic authentication to resist channel insertion attacks, but it usually encounters difficulties in choosing a specific period interval. Too long a period interval will leave opportunities for intruders; too short a period interval will increase the calculation of both authentication parties. quantity. At the same time, when fine-grained access control is to be implemented for each originator, the administrator needs to manually create a user...

AI Technical Summary

Problems solved by technology

Although the above two access control mechanisms extended by the iSCSI protocol solve the problem of password leakage in CHAP authentication, these two mechanisms require multiple encryption and decryption operations on the target side to determine whether to allow the login request from the originating side.

In addition, neither of these two mechanisms can revoke the originator's access to logged-in storage resources, and it is difficult to implement fine-grained access control for each originator

Images